From dc406c4f56da0b1025b061689749a6ae43239676 Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Mon, 5 Oct 2026 13:41:57 +1100
Subject: [PATCH 1/3] Add boot unit applying a local config

---
 packaging/nfpm.yaml              | 11 +++++++++++
 packaging/tomswall-agent.service |  1 +
 packaging/tomswall.env           |  2 ++
 packaging/tomswall.service       | 19 +++++++++++++++++++
 4 files changed, 33 insertions(+)
 create mode 100644 packaging/tomswall.env
 create mode 100644 packaging/tomswall.service

diff --git a/packaging/nfpm.yaml b/packaging/nfpm.yaml
index 823bd11..a74f673 100644
--- a/packaging/nfpm.yaml
+++ b/packaging/nfpm.yaml
@@ -47,6 +47,17 @@ contents:
     file_info:
       mode: 0640
 
+  # systemd unit + environment file for applying a local config at boot.
+  - src: packaging/tomswall.service
+    dst: /usr/lib/systemd/system/tomswall.service
+    file_info:
+      mode: 0644
+  - src: packaging/tomswall.env
+    dst: /etc/tomswall/tomswall.env
+    type: config|noreplace
+    file_info:
+      mode: 0644
+
   # Shell completions (generated by scripts/build-rpm.sh before packaging).
   - src: dist/completions/tomswall.bash
     dst: /usr/share/bash-completion/completions/tomswall
diff --git a/packaging/tomswall-agent.service b/packaging/tomswall-agent.service
index 8996b03..f078634 100644
--- a/packaging/tomswall-agent.service
+++ b/packaging/tomswall-agent.service
@@ -3,6 +3,7 @@ Description=tomswall control-plane agent (pull and apply firewall config)
 Documentation=https://git.unkin.net/unkin/tomswall
 After=network-online.target
 Wants=network-online.target
+Conflicts=tomswall.service
 
 [Service]
 Type=simple
diff --git a/packaging/tomswall.env b/packaging/tomswall.env
new file mode 100644
index 0000000..883006c
--- /dev/null
+++ b/packaging/tomswall.env
@@ -0,0 +1,2 @@
+# Config applied by tomswall.service: a tomswall YAML file or a shorewall directory.
+TOMSWALL_CONFIG=/etc/tomswall/tomswall.yaml
diff --git a/packaging/tomswall.service b/packaging/tomswall.service
new file mode 100644
index 0000000..622d0a5
--- /dev/null
+++ b/packaging/tomswall.service
@@ -0,0 +1,19 @@
+[Unit]
+Description=tomswall firewall (apply local config at boot)
+Documentation=https://git.unkin.net/unkin/tomswall
+Wants=network-pre.target
+Before=network-pre.target
+After=local-fs.target systemd-sysctl.service
+Conflicts=tomswall-agent.service
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+Environment=TOMSWALL_CONFIG=/etc/tomswall/tomswall.yaml
+EnvironmentFile=-/etc/tomswall/tomswall.env
+ExecStart=/usr/sbin/tomswall apply -c ${TOMSWALL_CONFIG}
+ExecReload=/usr/sbin/tomswall apply -c ${TOMSWALL_CONFIG}
+# No ExecStop: stopping the unit leaves the ruleset in place (flush would open the firewall).
+
+[Install]
+WantedBy=basic.target

From 7fcbb5fad8f4fd66ba3e3db13700148ec01478b8 Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Mon, 5 Oct 2026 13:44:58 +1100
Subject: [PATCH 2/3] Order boot unit before sysinit and retry on failure

---
 packaging/tomswall.env     |  1 +
 packaging/tomswall.service | 10 +++++++---
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/packaging/tomswall.env b/packaging/tomswall.env
index 883006c..de01378 100644
--- a/packaging/tomswall.env
+++ b/packaging/tomswall.env
@@ -1,2 +1,3 @@
 # Config applied by tomswall.service: a tomswall YAML file or a shorewall directory.
 TOMSWALL_CONFIG=/etc/tomswall/tomswall.yaml
+#TOMSWALL_CONFIG=/etc/shorewall
diff --git a/packaging/tomswall.service b/packaging/tomswall.service
index 622d0a5..61f1931 100644
--- a/packaging/tomswall.service
+++ b/packaging/tomswall.service
@@ -1,10 +1,11 @@
 [Unit]
 Description=tomswall firewall (apply local config at boot)
 Documentation=https://git.unkin.net/unkin/tomswall
+DefaultDependencies=no
 Wants=network-pre.target
-Before=network-pre.target
+Before=network-pre.target shutdown.target
 After=local-fs.target systemd-sysctl.service
-Conflicts=tomswall-agent.service
+Conflicts=shutdown.target tomswall-agent.service
 
 [Service]
 Type=oneshot
@@ -13,7 +14,10 @@ Environment=TOMSWALL_CONFIG=/etc/tomswall/tomswall.yaml
 EnvironmentFile=-/etc/tomswall/tomswall.env
 ExecStart=/usr/sbin/tomswall apply -c ${TOMSWALL_CONFIG}
 ExecReload=/usr/sbin/tomswall apply -c ${TOMSWALL_CONFIG}
+# Fails open: once restarts are exhausted, boot continues without the ruleset.
+Restart=on-failure
+RestartSec=5
 # No ExecStop: stopping the unit leaves the ruleset in place (flush would open the firewall).
 
 [Install]
-WantedBy=basic.target
+WantedBy=sysinit.target

From 502d06bddaff42de8ec33e9af707aa0db61ec58f Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Mon, 5 Oct 2026 13:46:50 +1100
Subject: [PATCH 3/3] Cap boot unit restarts so it fails open

---
 packaging/tomswall.service | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/packaging/tomswall.service b/packaging/tomswall.service
index 61f1931..7d714da 100644
--- a/packaging/tomswall.service
+++ b/packaging/tomswall.service
@@ -6,6 +6,8 @@ Wants=network-pre.target
 Before=network-pre.target shutdown.target
 After=local-fs.target systemd-sysctl.service
 Conflicts=shutdown.target tomswall-agent.service
+StartLimitIntervalSec=60
+StartLimitBurst=5
 
 [Service]
 Type=oneshot
@@ -14,7 +16,7 @@ Environment=TOMSWALL_CONFIG=/etc/tomswall/tomswall.yaml
 EnvironmentFile=-/etc/tomswall/tomswall.env
 ExecStart=/usr/sbin/tomswall apply -c ${TOMSWALL_CONFIG}
 ExecReload=/usr/sbin/tomswall apply -c ${TOMSWALL_CONFIG}
-# Fails open: once restarts are exhausted, boot continues without the ruleset.
+# Fails open: after StartLimitBurst failures within StartLimitIntervalSec, boot continues without the ruleset.
 Restart=on-failure
 RestartSec=5
 # No ExecStop: stopping the unit leaves the ruleset in place (flush would open the firewall).